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(54) PROCEDE D-ANALySE DU TRAFIC EN TEMPS REEL SUR DES RESEAUX DE COMMUTATION PAR 
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(57) 

An architecture for capture and generation, and a 
set of methods for characterization, prediction, and 
classification of traffic in packet networks are 
disclosed. The architecture consists of a device that 
stores packet timing information and processes the data 
so that characterization, prediction, and 
classification algorithms can perform operations in 
real-time. A methodology is disclosed for real-time 
traffic analysis. characterization, prediction, and 
classification in packet networks. The methodology is 
based on the simultaneous aggregation of packet arrival 
times at different times cales. The traffic is 
represented at the synchronous carrier level by the 
arrival or non- arrival of a packet. The invention does 
not require knowledge about the information source, nor 
needs to decode the information contents of the 
packets. Only the arrival timing information is 
required. The invention provides a characterization of 
the trafnc on packet networks suitable for a real-time 
implementation. The methodology can be applied in real- 
time traffic classification by training a neural 
network from calculated second order statistics of the 
traffic of several known sources. Performance 
descriptors for the network can also be obtained by 
calculating the deviation of the traffic distribution 
from calculated models. Traffic prediction can also be 
done by training a neural network from a vector of the 
results of a given processing against a vector of 
results of the subsequent processing unit; noticing 
that the tatter vector contains information at a larger 
time scale than the previous. The invention also 
provides a method of estimating an effective bandwith 
measure In real time which can be used for connection 
admission control and dynamic routing in packet 
networks. The invention provides appropriate traffic 
descriptors ttiat can be applied in more efficient 
traffic control on packet networks. 
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(57) L 'invention concerne une architecture d'accrochage 
et de g^n^ration, ainsi qu'un ensemble de proc6d^s de 
caraclcrisalion, prevision ct classificaLion du Irafic dans 
des ri^seaux de conmiutation pai" paquets. L'arcliitecture 
est formee d'un dispositit' qui enregistre les inibrmations 
teraporelles concemant les paquets et traite les donnees 
de man! ere k ce que les algorithmes de caractdrisation, de 
prevision cl dc classification puisscnt cffccLucr dcs 
operations en temps reel. L 'invention a aussi ti'ait a un 
moyen de proceder pour mener a bien Tanalyse du trafic 
en temps reel, la caract^risation, les provisions et la 
classification dans des r^seaux de commutation par 



(57) An architecture for capture and generation, and a set 
of methods for characterization, prediction, and 
classification of traffic in packet networks arc disclosed. 
Tlie architectvue consists of a de\dce tliat stores packet 
timing information and processes the data so that 
characterization, prediction, and classification 
algorithms can perform operations in real-time. A 
methodolog>' is disclosed for rcal-limc traffic analysis, 
characterization, prediction, and classification in packet 
networks. The methodology is based on the simultaneous 
aggregation of packet anival times at different times 
cales. The traffic is represented at the synchronous 
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paquets. Le procede se fonde sur le regroupement 
simultand de temps d'arrivee des paquets d des ^chelles 
diffcrcnlcs dc Icmps. Lc Irafic est rcprcscnlc au niveau dc 
porteur synclirone par Tanivee ou la non-anivee d*un 
paquet. L 'invention ne necessite ni une connaissance de 
la source d'information, ni le d^codage du contenu des 
informations des paquets. Seule rinfonmation 
tcmporcllc d'anivcc csl rcquisc. L 'invention foumit unc 
caracterisation du trafic dans des reseaux de 
commutation par paquets convenant a une realisation en 
temps r^el. La mani^re de procdder peut Stre appliquee 
dans une classification du trafic en temps r^el par la 
formation d'un ordinatcur neuronal a parlir de oaleuls 
des statistiques de second ordre du trafic de plusieurs 
sources connues. Les descripteurs de performances pour 
le reseau peuvent aussi etre obtenus par le calcul de 
l'6cart de la distribution du trafic par rapport k des 
modeles caleules. Les previsions de Irafic se font aussi 
pai* la formation d'un reseau neuronal a partir d'un 
vecteur des resultats d'un traitement donne a Tencontre 
d'un vecteur de resultats de Tunite de traitement 
ultdrieure; en remarquant que le vecteur suivant contient 
des informations a une eehelle temporelle plus grande 
que ranterieur. L 'invention porte aussi sur un procede 
d*evaluation d'une mesure efificace de largetu* de bande 
en temps r6el susceptible de servir pour la gestion du 
dmit de connexion et Tacheminement dynamique dans 
des reseaux de commutation par paquets. L'invention 
propose des descripteurs de trafic adaptes pouvaiit etie 
mis en oeuvre dans une gesuon plus efficace du trafic 
dans des reseaux de commutation par paquets. 



carrier level by the arrival or non-arrival of a packet. ITie 
invention does not require knowledge about the 
information source, nor needs to decode the information 
contents of the packets. Only the arrival timing 
information is required. The invention provides a 
characterization of the traffic on packet net>;\'orks 
suitable for a real-time implementation. The 
methodolog>' can be applied in real-time traffic 
classification by training a neural network from 
calculated second order statistics of the traffic of several 
known sources. Performance descriptors for the network 
can also be obtained by calculating the deviation of the 
traffic distribution from calculated models. Traffic 
prediction can also be done by training a neural network 
from a vector of the results of a given processing against 
a vector of results of the subsequent processing unit; 
noticing that the latter vector contains information at a 
larger time scale than the previous. The invention also 
pro\'ides a method of estimating an effective bandwitli 
measure in real time which can be used for connection 
admission control and dynamic routing in packet 
networks. The invention pro\ndes appropriate traffic 
descriptors that can be applied in more eflieient traffic 
control on packet netwoiks. 
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(57) Abstract 

An aichitecture for capture and genera- 
tion, and a set of methods for diaiacterization. 
prediction, and classification of traffic in packet 
networks are disclosed. The axdiitecture con- 
sists of a device that stores packet timing in- 
formation and processes the data so that char- 
acterization, prediction, and classificadon atgo- 
riduns can perform operadons in real-time. A 
methodology is disclosed for real-time traffic 
analysis, characterization, prediction, and clas* 
sification in paclcet networks. The methodol- 
ogy is based on the simultaneous aggregation of 
packet aiTzvai times at different times cales. The 
traffic Is represented at the synchronous carrier 
level by the anival or non-airival of a packet. 
The invention does not re({uire knowledge about 
the information source, nor needs to decode the 
infonnation contents of the packets. Only the 
arrival timing information is required. The in- 
vention provides a characterization of the traffic 
on packet networks suitable for a real-time im- 
plementation. The methodology can be applied 
in reaJ-time traffic classification by training a 
neural network from calculated second order 
statistics of the traffic of several known sources. 

Performance descriptors for the network can also be obtained by calculating the di^viation of the traffic distribution from calculated models. 
Traffic prediction can also be done by training a neural network from a vector of the results of a given processing against a vector of 
results of the subsequent processing unit; noticing that the latter vector contains information ac a larger time scale than the previous. The 
invention also provides a method of estimating an effective bandwith measure in real time which can be used for connection admission 
control and dynamic routing in packet networks. The invention provides appropriate traffic descriptors that can be applied in more efficient 
traffic control on packet networks. 
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Method for Raal-Tfi ne Traffic Analysis on Packet Networks 
The Field ofttie Invention: 

This invention relates in general to traffic analysis on packet networks. Packet 
networks are telecommunication networks in which the information is transmitted in small 
binary groups called packets. An advantage of packet networks is that it can haruile 
different sources simultaneously by processing the packets sequentially. The packets 
travel through the network via a f^st synchronous carrier this can be viewed as a train of 
pulses which transport the packets. The speed of this canier determines the maximum 
speed of the packet network. These networks can process only one packet at a time and 
thus the order in which the packets are processed depends on the priorities and quality of 
service required by the sources. Packets from a given source are mixed with packets from 
other sources. Each packet has a header that identifies its destination. Once the packets 
arrive at their destination, the headers are removed and the Infonnation is reassembled. 
Since these networks generally carry traffic from different types of sources which demand 
different service levels from the network, It is important from a network operation and 
management point of view to know the characteristics of the expected traffic. In the 
standards fbr packet networio that use the asynchronous transfer mode protocol (ATM), 
the traffic is described by first order statistics such as the peak cell rate, cell delay 
variation tolerance, sustainable ceil rate, and maximum burst size. The size of the packets 
in ATM networics (that is networia vwhich utifize the ATM protocol) is 53 bytes, of wNch 5 
bytes compose the header and the remaining 48 bytes contain a section of the intbmation 
being transmitted. The rate is defined as the number of packets that flow through the 
networi< in a given unit of time; this is a measure of the speed of the telecommunications 
network. The peak cell rate is defined as the inverse of the minimum time between 
successive packet arrivals to a switch. The cell delay variation tolerance is defined as the 
sensitivity of the information to changes in delay of the packets as they flow through the 
networit The sustainable cell rate is defined as the majdmum average rate. The maximum 
burst size is defined as the maximum number of cells at the peak rate. Two of these 
parameters, the peak cell rate and the sustainable cell rate, have been defined as 
mandatory traffic parameters (or descriptors) in the ATM Forum UNI version 3.0 
standards, as explained by McOysan and Spohn [HJ, 

There are two types of networics whh:h differ acconling to the way a connection is 
handled. The first type Is connedion-orientBd. In these networics it is required to set up 
several parameters belbre any data transmission can take place. This is a process in 
vyhlch a source negotiaies a level of service virith the networic An end-to-end path with a 
quality of sennce is established and all the packets from the source will follow this path. 
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The second type is connectionless in which it is not required to set up an end-to-end 
connection. The network handles the packets individually. 

Quality of service (QoS) Is a parameter meaningful from a source to a destination 
point of view, as well as at each link in the network. In connection-oriented networks, the 
negotiation for a QoS is carried out by agreeing on certain parameters. These parameters 
are based on first order statistical measures of the perfomiance, such as the average 
delay, cell delay variation, error rates, and different levels of packet loss, as explained in 
tiie Bellcore requirements for broadband switching systems p]. 

Packet networks have been designed to carry traffic from multimedia sources, 
among them different types of video and audio, voice, and data communications. Each 
traffic source presents the network with different requirements. The network must be able 
to handle ail these traffic sources at tiieir respective quality of senrice. The problem that 
arises is how to accurately characterize the different traffic sources for efficient network 
utilization. It might, in fact, be required to measure quality In different ways for different 
traffic sources. This makes the perfonnance measurement problem very complex. 

In our invention, a method is used to characterize the traffic in real-time. The 
method is used to calculate traffic descriptors considering properties of the traffic which 
have not been considered previously in commercial equipment. The descriptors are based 
on properties of the traffk; that have been reported in the literature; but ttie techniques 
available are not suitable for real-time measurements. The algorithm presented Is based 
on tiie simultaneous measurement of tiie traffic at different time scales. The data is 
represented in an appropriate form, processed and organized in an array of vectors. From 
this array, higher order statistical measures are derived. The traffic descriptors calculated 
in this way are used to characterize the traffic. The algoriBim is implemented in real-time. 
The information is also used for traffic classification and perfomiance prediction. 
The Description of Related Art: 

The following references have been identified in a search in tills field, some of 
which are relevant to the present invention: 

Publications 

[1] R. Adcfie, M. Zukemian. and T. Neame, "Fractal Traffic: Measurements, 
Modelling and Performance Evaluation", In Proc. IEEE Infocom. pp. 977-984, 
1995. 

P] BeHcore, "Broadband Switching System Generic Requirements", GR-1110- 
CORE, Revision 3, April 1996. 
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PJ J. Beran, R. Sherman, M. Taqqu, and W. Willinger. "Long-Range Dependence 
In Variable-Bit-Rate Video Traffic", in IEEE Trans, on Communications, vol. 43, 
no. 4. pp. 1568-1579, April 1995. 

[4] Y. Chen. Z Deng, and C. Williamson. "A Model fbr Self-Similar Ethernet LAN 
Traffic: Design, implementation, and Pertiomfwnce Implications". Internal report, 
University of Saskatchewan. Canada, 1995. 

15] M. Devetsikiotis, I. Lambadaris. R. Kaye, Traffic Modeling and Design 
Methodologies for Broadband Networks", Canadian Journal on Electrical and 
Computer EngineerinsT, vol. 20, no. 3, 1995. 

[61 M. Garrett and W. WBBnger, "Analysis, Modeling and Generatkin of Self-Similar 
VBR Video Traffic", in Proc. ACM Sigcom, London. UK, pp. 269-280, 1994. 

[7] R. Guerin. H. Ahmadi and M. Naghshineh, 'Equivalent Capacity and its to 
Bandwidth Allocation in High Speed Networics". lEEEJSAC, vol. 9. no. 7. 1991. 

[8] C. Huang, M. Devetsikiotis, I. Lambadaris, and A. Kaye, 'Modeling and 
Simulation of Self-Similar Variable Bit Rate Compressed Video: A Unified 
Approach", in ACM Sigcom. Cambridge 1995. 

[9] W. Lau. A. Erramilii. J. Wang, and W. Willinger, "Self-Similar Traffic Generatksn: 
The Random Mi^nint Displacement Algorithm and its Properties", in Proc. IEEE 
Int Conf. Commun., 1995. 

[10] W. Leiand, M. Taqqu, W. Willinger, and D. Wilson, "On The Self-Similar 
Nature of Ethemet Traffic (extended version)", IEEE/ACM Trans. Networking, vol. 
2. no. 1. pp. 1-15, Febniary 1994. 

[1] B. Mandelbrot. "Self-Similar Error Clusters in Communication Systems and the 
Concept of Condftional Statlonarity", in IEEE Trans, on Communication 
Technology, pp. 71-90, 1985. 

[12] D. McDysan and D. Spohn. "ATM Theory and AppOcatlon". Toronto: McGraw>- 
HUI. 1995. 
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[13] D. McLaren and D. Nguyen, "A Fractat-Based Source Model for ATM Packet 
Video", in Int. Conf. on Digital Processing of Signals in Communications, Univ. of 
Loughbovough, September 1991. 

[14] V. Paxson, "Fast Approximation of Self-Similar Network Traffic", report LBU 
36750, Univ. of Califomia at Berkeley. Lawrence Berkeley Laboratory, 199S. 

[15] A. Rueda and W. Kinsner, "A Survey of Traffic Characterization Techniques In 
Telecommunication Networks", Prvc, IEEE Canadian Conference on Electrical and 
Computer Engineering, pp. 830-833, May 1996. 

U.S. Patents 

5,050161 Congestion management based on multiple framing strategy 

5,274,625 Traffic measurements in packet communication networks 

5,341 ,366 Connection admission control sy^em 

5,343.463 Performance measurement system for a telecommunication path 
and device used therein 

5.343,465 Method and system for real-time burstiness analysis of network 
traffic 

5,357,507 Fast connection admission control for ATM networks 

5.357,510 Apparatus and method for supervising and controlling ATM traffic 

5,365,514 Event driven interface for a system for monitoring and controlling a 
data communications networi^ 

5,375,070 Information collection architecture and method for a data 

communications networic 

5,394,394 Message header classifier 

5,426,635 Method for adaptive control of windows and rates in networics 
5,434,848 Traffic management in packet communication networics 
5,448,567 Control architecture for ATM networics 
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The traffic characterization techniques tor telecommunication networks found In the 
literature can be classified Into the following categories [5], [14]: autoregressive moving 
average (ARMA) models. Bernoulli process modeling, Markov chain modeling, neural 
network models, setf-similar models, transform-expand-sample (TES) models, traffic flow 
models, and wavelet models. 

Different kinds of stochastic (statistical) models reported in the literature have 
successfully been used in modeling traffic In telecommunication networks. For exan^e, 
Markov chains are a useful tool in modeling communication systems. It is wklely accepted 
that the short-tenn arrival processes in telecommunication networks can be accurately 
described by Poisson processes, for example an FTP control connection which can be 
modeled as a Markov modulated Poisson process (MMPP) [13]. 

Traffic on packet networks is inegular in nature as explained by Leiand, et al. [9]. It 
is generally accepted that the long-range dependencies found in multimedia traffic can be 
described using models which consider self-similarity. Self-similarity is a measure of the 
variation of the traffic properties at different time scales. Several traffic models of this type 
have been reported [1J. [4], pj, [T], [8], and [12]. 

The traffic descriptors that have been utilized in packet networks are based on 
statistical measures such as the mean, peak and sustained rates, burst length, and cell- 
toss ratios. These do not quantify correlatton well, and thus a need exists for descriptors 
that provide more infomiation in order to describe highly coneiated and bursty (irregular) 
multimedia traffic [3] and [10]. 

Traditional analysis techniques cannot be successfully applied. The methods that 
have been proposed for the analysis of traffic in packet networks are impractical for a real- 
time implementation since they required caiculattons that involved several processing 
phases on a stored time series. 

A method for time deviation (TDEV) calculation for synchronization monitoring in 
SONET/SDH networks is proposed by Grover and Stamatlakis [15]. Their method consists 
of the calculation of simultaneous averages of the second differences of time interval 
errors (TIE) at different time scales. A time scale is represented by blocks that contain a 
number of second differences which is a power of two. For each btock the second 
differences are added and the result is squared. The sums of the squares are then divided 
by six and by a constant to obtain a measure called the time variaice (TVAR) for the lime 
scale. Each new TIE value produces a new second differences and this is used to updated 
aU the block sums of all the time scales. Each new second dlff^erence could complete a 
block sum for one or more blocks and a new TVAR couU be obtained. The results are 
used to produce a plot of the togarithm base two of the TVAR values of all the btodcs 
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versus the logarithm base two of the block size. Their paper also details the standard 
block calculation which consists of calculating the TVAR values for all the btocks in a 
batch mode (or block mode, or off-line). This consists of calculating the block sums and 
TVAR values of a time series of TIE values for each block separately. 

[7] W. D. Grover and D. Stsmiatlakis, "Continuous TDEV calculatton fbr in-situ 
synchronisation monitoring in SONET/SDH networks", Electronic Letters, vol. 29, 
No. 16, pp. 1405-1406, August 1993. 

Namajunas and Tamasevicius [16] proposed a devtee for measuring fractal 
dimensions from a time series in real-time. Their device is an electronic circuit that 
produces an approximation to the fractal dimension of a class of snatog electric signals in 
real-time. 

18] A. Namajunas and A. Tamasevicius, "A technique fbr measuring fractal 
dimensfans from time series on a real-time scale", Phymca D. vol. 58, pp. 482-488, 1992. 
SUMMARY OF THE INVgNTiQM 

it Is one object of the present invention to provide a method for 
characterizing transmissions in a packet networi^ which may or may not be carried out in 
real time and may provide information which can be used to characterize the 
transmissions for prediction and access control. 

According to a first aspect of the invention there is provided a method for 
deriving information related to characteristics of transmissions in a packet networic 
comprising: 

providing a packet networic for carrying a plurality of transmissions from at 
least one source in which the transmissions from the or each source are divided into a 
plurality of sequential packets each packet having address data defining an intended 
address, Infbrmation data defining information to be transmitted and id data defining a 
source Mentity; 

the network defining a train of sequential packet transport locations into 
which packets are toaded for transmisston. such that some packet transport tocations in a 
train contain packets and some packet transport locations are empty and such that, when 
there is more than one drfferent source, the train contains packets from the different 
sources in a sequential arrangement as determined by the networic; 

monitoring a train of packet transport locations to determine which packet 
transport locations are empty and which contain a packet; 

generating a series of data elements each corresponding to a respective 
one of the packet transport locations and each identifying whether tiie respective packet 
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transport location is empty or whether the respective pad^et transport location contains a 
packet; 

and carrying out statistical analysis on the series of data elements to 
determine the characteristics of the transmissions. 

Preferably the statistical analysis is carried out in real time so that 
predictions and characterization of the transmissions can be done in real time. 

Preferably, as an alternative, the data elements are stored for example in 
the hard drive of a PC for subsequent analysis and the statistical analysis is carried out 
subsequent to completion of the transmissions when a series of transmissions have been 
recorded for analysis. 

Preferably the statistical analysis is carried out at a plurality of different time 
scales in order to provide the calculations as set out heneinafler. Preferably the statistical 
analyses are earned out simultaneously by providing for each different time scale a 
respective one of a plurality of registers and entering infomiation from the data elements 
into each register sequentially. 

Preferably, in a simple single mode, the data elements comprise data bits 
defining '0" when the respective packet transport tocMon is empty and "1" when the 
respective packet transport location contains a packet and wherein the infomiation for 
each register is obtained by adding the contents of a next adjacent prevtous register. 

Using the data bits, the analysis includes, for each register, calculating the 
sample variance of a set of successive obsen/ations of the register contents and from the 
variances estimating a value of the Hurst parameter H, which is the slope of a line which 
approximates the behavior of a plot of the logarithm of the variances of the registers 
versus the values of the sequential indices of the registers. This parameter is known per 
se but the present algorithm provides a technique for calculating this parameter In real 
time. 

When the packets in the train are provided by a plurality of different sources 
the data elements are arranged to identify a packet transport tocatton as containing a 
packet only when the packet is identified from the id data as provided by a selected one of 
the sources such that the characteristks determined relate to only the transmissions from 
the selected source. 

When the packets in the train are provided by a plurality of different sources 
the data elements are anranged to tdenWy a packet transport tocation as empty when no 
packet from any of the sources is contained and to Uentify when a packet transport 
location ooritains a packet from the kJ data as provkled by each one of the sources which 
source provkied the packet 
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The characteristics determined from the data elements can be used to 
provide a calculation of an effective bandwidth of the transmissions for use in access 
control and prediction. 

In particular the above method can be used in one example for determining 
whether a source additional to a plurality of existing sources of padcet transmissions, each 
source having a predetermined peak rate of packet transmission, can be connected to a 
packet network, where a transmission medium of the network has a predetermined 
maximum allowable peak rate of transmissk)ns. This is preferable effected by the steps ot 

carrying out in real time the statistical analysis on the series of data 
elements to determine an effective bandwidth of the transmissions from the existing 
sources; 

and calculating whether the additional source can be connected by 
comparing the effective bandwidth, the predetermined peak rate of packet transmission of 
the additional source and the predetermined maximum allowable peak rate of 
transmissions of the transmission medium of the network. 

As an alternative, the method can be used for calculating whether a source 
additional to a plurality of existing sources of packet transmissrons, each source having a 
predetermined peak rate of packet transmission, can be connected to a second packet 
networic, a transmission medium of the second packet network having a predetenmined 
maximum allowable peak rate of transmisstons. This is effected by the steps ot 

connecting the additional source to the packet network; 

generating said series of data elements from transmissions from said 
additional source to said packet network; 

carrying out in rsal time the statistical analysis on the series of data 
elements to determine an effective bandwidth of the transmissions from said additional 
source; 

and calculating whether the additional source can be connected to the 
second packet networic by using the effective bandwidth of the transmissions from said 
additional source. 

According to a second aspect of the inventton there is provided a method 
for deriving information related to the characteristics of transmissions in a packet networic 
compri«ng: 

providing a packet networic for canying a plurality of transmissions from at 
least one source In which the transmissions from the or each source are divkJed into a 
plurality of sequential packets each packet having address data defining an intended 
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address, information data defining information to be transmitted and id data defining a 
source identity; 

the network defining a train of sequential packet transport locations into 
which packets are loaded for transmission, such that some packet transport locations In a 
train contain packets and some packet transport locations are empty and such that, when 
there is more than one different source, the train contains packets from the different 
sources in a sequential arrangement as detemfiined by the network; 

monitoring a train of packet transport locations to detemnine which packet 
transport locations are empty and which contain a packet; 

generating infonnation defining which packet transport locations contain a 
packet and the empty locations therebetween; 

and canying out simultaneously and in real time a series of statistical 
analyses on the infomiation at a plurality of different time scales to detennine the 
characteristics of the transmissions. 

In this aspect, the information is not necessarily the data bits as set forth 
above but can include other infonmation relating to the popuJation of the packets. However 
in this aspect, the analysis is effected in real time. Preferably however as explained in 
detail hereinafter, the information comprises a series of data elements each corresponding 
to a respective one of the packet transport locations and each identifying whether the 
respective packet transport location is empty or whether the respective packet transport 
Ideation contains a packet and wherein the statisticai analyses are earned out by providing 
for each different time scale a respective one of a plurality of registers and entering 
information from the data elements into each ragister sequentially. 

More preferably the data elements comprise bits which define "0" when the 
respective packet transport location is empty and -r when ihe respective packet transport 
location contains a packet and wherein the Infomiation for each register is obtained by 
adding the contents of a next adjacent previous register. 

Acconling to a third aspect of the present invention the same technique for 
generating bits relating to the empty and filled packets can be used in reverse in a method 
of generating packet transmisstons for simulating a source having required transmission 
characteristics for transmitting on a packet networic comprising: 

provkJing a packet networic for canying a plurality of transmissions from at 
least one source in which the transmisskms from the or each souroe are divided into a 
plurality of sequential packets each packet having address data defining an intended 
address, information data defining infonnation to be transmitted and Id data defining a 
source identity; 
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the network defining trains of sequential packet transport locations into 
which packets are loaded for transmission, such that some packet transport tocations in a 
train contain packets and some packet transport locations are empty and such that when 
there is more than one different source, the train contains packets from the different 
sources in a sequential arrangement as determined by the network; 

from a statistical analysis of prevtous actual trartsmissions on the network, 
generating for the sirhulated source the required characteristic; 

generating from the required characteristic a series of data elements each 
conesponding to a respective one of the packet transport tocattons and each specifying 
whether, in a simulated train of packets, a respective packet transport locatton is empty or 
whether the respective packet transport location contains a packet; 

and creating from the data elements the simulated packet train. 

Thus as set forth above, a methodology is disclosed for real-time traffic analysis, 
characterization, prediction, and classification in packet networks. The methodology is 
based on the simultaneous aggregation of packet arrival times at different time scales. 
The traffic is represented at the synchronous carrier level by the arrival or non-anival of a 
packet. The invention does not require knowledge about the source, nor needs to decode 
the infomnation contents of the packets. Only the anlval timing infonnation is required. The 
binaiy representation of the traffic, that is, the anlval or non-arrival indicator, is processed 
by a series of processing units and organized in an anay of vectors. The processing units 
are ananged in a series in such a way that the each processing unit operates with the 
result from the previous unit The first processing unit operates directly with the timing 
Infonnation. The results of all the processing units are organized In the array of vectors 
and from these vectors information about the traffic can be derived. Statistical measures 
on the vectors such as variance, provide appropriate parameters at different time scales to 
calculate traffic descriptors. These descriptors encapsulate different properties of the 
traffic, such as burstiness and self-similarity, which were prevtously not considered In 
traffic management on packet networics. 

A characterizatton is obtained of the traffic on packet networics suitable for a real- 
time implementation. The methodotogy can be applied In real-ttme traffic classification by 
training a neural networtc from calculated second order statistics of the traffic of several 
known sources. Performance descr^rs for the networic can also be obtained by 
calculating the deviation of the traffic distribution from calculated models. Traffic prediction 
can also be done by training a neural networtc from a vector of the results of a given 
processing against a vector of results of the subsequent processing unit; noticing that the 
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later vector contains information at a larger lime scale than the previous. The data 
produced by the algorithm can also be used for perfomiance prediction. 
BRIEF DESCRI PTION QFTHg DRAWINGS 

One embodiment of the invention will now be described in conjunction with the 
accompanying drawings in which: 

Figure 1 illustrates the algorithm. The timing infbnnafion from the synchronous line 
Is represented by a *r rf a packet arrival has occurred, and a '0' otherv^e. This 
information is processed and organized in vectors. The different components of the 
algorithm have been labeled. 

Figure 2 shows an application of the algorithm in ATM networtis. This is a 
particular case of the algorithm. The required values of the parameters are shown in the 
figure. The input infomnation is SONET OC3/OC12. which is a standard synchronous 
carrier for ATM. 

Figure 3 is a diagrem showing the first method used to construct the H-meter 
algorithm input stream of I's and O's from ATM capture cell timestamps. 

Rgure 4 illustrates the second m^od of re-producing the ATM traffic stream. This 
method eliminates the first four columns of the array. 

Figures describes the data representation process. 

Figures descrit)es the data generation pioceas. 

Figure 7 represents the data representation process for two channels. 

Rgure 8 shows a blocic diagram of the implemaitation of the algorithm in a 
parallel processing platfbnn with four processors. 

Figure 9 shows a block diagram of an optimized implementation of the algorithm in 
a parallel processing platform with three processors. 

Figure 10 depicts an application of the algorithm in characterization of moving 
images. The coefficient of variation of the vectors has been plotted for different quality 
factors of the transmission. The plot shows the logarithm of the coefficient of variation of 
the vectore against the logarithm of the 2 to the power of the vector number. Using this 
technique K can be determined how the statistical properties of the traffic vary as a 
function of the quality level of the video cwnpression. 

Figure 11 illustrates an appfication of the invention in traffic classification. The 
vertical axis is the log of the variance, and the horizontal axis is the log of the bin size 
index. The plots represent typical varianoa-time curves of transmissions of video, audio, 
and ftp pe transfer protocol) signals. A variance-time cunre is a plot of the logarithm of 
the variance of the vectors against the logarithm of two to the vector number. The plot for 
each stream is dearty distinct from the others. Since the plots can be constructed in real- 
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time as the vectors are being calculated, this technique can be applied in real-time to 
characterize the traffic from measures of the variance-time cun/es. 

Figure 12 aiustrates tfie process of generating the Hurst parameter H from 
variance time curves. That Hurst parameter is calculated at different time intervals and a 
plot is constructed with the different values of H. The resolution of the graph depends on 
the tenth of the time intenrals. 

Figure 13 shows an application of the algorithm for calculation of the H parameter 
of the 'jump to hyperspace' scene of the StarWars movie. At tiie centre of the the plot (left- 
hand side image) it is seen that tiie H parameter increases in value as the images 
changes. This is a motion JPEG encoded transmission of the video over an ATM network. 

Figure 14 illustrates the application of the algorithm in classification of different 
traffic streams. A scene with tiie character R2D2 from the motion JPEG-coded StarWars 
movie over ATM is compared agalns an audio transmission of the same movie. 

Figure 15 shows that application of the algorithm to the obsen/ation of scenes of 
high activity from the motion JPEG-coded StarWars movie. 

Figure 16 shows the detrended data as presented to the neural networi^ classifier. 

Figure 1 7 depicts a diagram of the competitive leaming-based neural network fliat 
solves tiie data classification problem. 

Figure 18 shows the after-training weight vectors of the neural networic classifier 
indicated by a 'o\ and input vectors indicated by a . 

Figure 19 illustrates one method of calculating maximum queue length. 

Figure 20 illustrates ttie method of calculating maximum queue iengfli emptoyed in 
ttie estimation of effective bandwidth. 

Figure 21 illustrates tiie calculation of tiie long term effective bandwidtii projection. 
DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT 

Referring to Figure 1, the data is processed and organized by an ordered series of 
bins, and stored in an ordered array of vecfors in such a way tiiat information can be 
derived regarding to^ffic at different time scales. Each bin consists of a primary 
accumulator and a secondary accumulator. A series of bits representing tiie presence ^'V 
or absence "0" of a cell or packet in successive transport locations of a traffic stream Is fed 
into tiie primary accumulator of ttie first bin of tiie series. The bins are labelled witti the 
integers {1,2,...,m} and ttie accumulators are labelled by pairs of integers of ttie form (ij) 
so that tiie accumulators in bin i are labelled (1,1) and (i.2) for tiie primary and secondary 
accumuiators (respectively) of bin i. Each accumulator has a number of memory locations 
and tiie number of memory locations in accumulator (ij) is represented by pg. 
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When an accumulator receives an integer, it stores the integer in the next available 
(i.e. empty) memory location if one is available! If all of the memory locations are full, then 
the accumulator computes the sum of all the Integers In its memory locations, ou^uts the 
result, dears (erases) all of Its memory locations and writes the new integer into the first 
memory location. When a primary accumulator outputs an integer, it passes it to its 
corresponding secondary accumulator (i.e. the other accumulator in its bin) and to the 
prinwry accumulator of the next bin in the series. When a secondary accumulator outputs 
an integer, it passes it to the vector which correqionds to Its bin (i e. the vector labeled 
with the same index). 

The array of vectors sc is used to store the information processed by the bins. 
Each vector can store n elements, w^ere n>2 is a constant. 

The bins are configured in two possible ways: a) as shift registers, or b) as 
recursive registers. The shift register receives a new element always in the first position 
and shifts down data already stored. The recursive nsgister stores a new element in the 
position of the array that holds the oldest element by replacing it. In both cases, the oldest 
elernent is then sent to the vector Sc for storage. Bin c is deared every time it has received 
qc or pc<7c elements (depending on the case chosen) and a datum has been calculated. 

Similarly, the vectors Sc are configured in two possible ways: a) as an anay of shift 
registers, or b) as an array of recursive registers. In the first case, a new element coming 
from bin c is stored in the first position of sc and the other elements are shifted. In the 
second case, a new element is stored in the position of the oldest element In both cases 
the oldest el^ent is dropped. 

The algorithm is organized such that the Integers passed to the vedor 5c of the 
array are the values of sums of nc successive bits of the binary stream fed into the 
primary accumulator of bin 1 where nc is given by 

These numbers thus reprssem the number of packets aniving in successive time 
Inten^als of duration nc each. We refer to nc as the bin count for bin c. 

The vectors Sc contain timing information at different tinfie scales. This infomiation 
can be used for characterization, prediction, and dassification of traffic. In the case of OCn 
trafTic analysis, the traffic can be encoded into a stream of 'I's and 'O's representing an 
arrival or non-arrival of a payload cell belonging to a particular VPIA/CI (virtual path 
Idantmer/virtual circuit identifier). Timing information of multiple connections is denoted by 
multiple bits. The time between two consecutive bits (or group of bits) is the minimum cell 
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spacing time. Le. maximum rate of the SONET line. This method can also be used to 
generate traffic from pre-loaded algorithms. This can be very useful for stress-testing 
switches. 

In the special case of this algorithm where pn =2 and Pb^I for each bin / the bin 
counts are given by ric ^2f, The algorithm starts with a stream of 'ts and 'O's as input A 
'1' represents an occupied ATM cell in a traffic stream. Similariy, a '0' represents an 
empty cell (no data). The data stream is presented to an accumulator. The first element 
is simply placed in the primary accumulator of bin 1. When the second element anives. rt 
is placed in the accumulator , added to the previous element and the sum is stored in an 
N-element vector farravV The sum is also passed to the primary accumulator for the next 
bin (colMmn) (which similariy adds every two inputs, stores the sum, and passes it to the 
next bin) (column). After an accumulator sum is stored, the accumulator is cleared (reset 
to 0) to await the next input Since the number of elements (rx)ws> in each vector (column) 
of the array is limited, when the limit is reached, an insertion pointer is reset to the 
beginning of the array (so that the next value stored ovenwrites the previous value). After 
a certain number of elements (or at the end of processing) each column calculates a 
variance measure of its array contents using the fomnuia: 

Var=^ crow*sumsci-ajm' 
crow*(crow-1)*4"*™ 

where crow is the number of elements In the array, sum Is the summation of the elements 
of the array, and sumsq is the sum of squares of the elements in the array, colnum is the 
identification number of the column (the first column has colnum=X the second has 
colnun^l, etc). 

From the column variances, the Hurst-parameter is found by the fonnula H = 1- 

p/2. 

where p represents the slope of the variance-time curve on a log-fog scale. Thus, the 
steeper the variance-time cun^ is, the smaller the corresponding Hur^t-parameter value 
must be. 

A first method of constructing the traffic stream is based on the comparison 
between the timestamp of the most recent cell to the timestamp of the previous cell. This 
would indicate how much time has elapsed between ceils. This Inten^al could then be 
divided by the minimum cell interval (for 1%0C-3, 0.00028 seconds) to determine how 
many 1%0C-3 cell periods had elapsed (these vrauM be the number of O's to insert Into 
the an-ay before ^sorting a 1. The major drawback of this method is that it would require 
floating-point division (as fractions of intervals would have to be taken into account). The 
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resulting implementation missed cells while the processor was busy doing the floating- 
point operation. 

A second method involves no floating-point operations at all. in the algorithm, a '1' 
or a t)' is input to the accumulator for the first column once every 0.00028 seconds (one 
1%0C-3 cell interval time). Since the second column accumulator, receives the sum of 
two numbers in the first, its rate is half of the previous column (it receives an Ir^xjt every 
0,00056 seconds). Continuing this to the fifth column, its accurmilatDr receives a new 
value once for every 32 cell inputs (2^. so Its 'arrival intefval' Is adualiy 32 1%0C-3 cell 
arrival times (0.00896 seconds). When the first cell arrives, its timestamp Ts_1 is noted, 
and the end of the first interval Ts_end (Ts_1+CPU_clock-ticks_fbr_2*_celIs) is calculated. 
The inten^al cell count is initialized to 1. When the next cell arrives, its timestamp is 
compared to the end of interval value. If the timestamp is less than Ts_end. the cell has 
arrived within the internal, and the cell count is incremented. If the timestamp is greater 
than Ts_end. the inten/al is over. The inten/al counter is inserted into the H-meter 
algorithm (this t^ at the fifth column) and the counter is then cleared. The next end of 
Inten/al is calculated as T8_end+ CPU_cloek-tlcks_fbr_2«..calls. TWs method counts the 
number of ceUs that arrive within a certain time period. H eHminates the woric of the first 
four columns, and involves no floating-point calculations in constmding the traffic stream 

Preparation of the Data: A device that prepares the infonnation for the algorithm is 
a networ1< interface card capable of generating and capturing, in real-time, ATM traffic at 
OC-3 rates. The card generates and captures traffic using a traffic profile which records 
the timing infonnation of an ATM traffic stream, without any retention of the ^edfic 
payload data within the ceils. The card is capable of generating and capturing traffic from 
3 virtual circuits (VC). 

At the heart of the capture/generation card, is an FPGA. The FPGA perfonns the 
ATM cell processing tasks, as weil as serving as the controller of operation of the card. A 
rriicrocontroller and an interface to a personal computer serial port are incorporated on the 
card. 

An AtM physical layer device supplies captured cells to the FPGA. This 
component also allows for ATM cell transmission, if enabled. RAM on the carel stores the 
loolc-up table for the headers the card is expected to capture. Logic on the card permits It 
to be plugged into the PCI slot of a PC, allowing a means of storing to disk the captured 
ATM traffic patterns. 

The representation of the ATM traffic stream in the traffic profile file is based on 
encryption of the ATM cell headen the oeH paytoad is ignored. During traffic capture, the 
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payload is dropped and for traffic generation, the payload of the outgoing cells is hard- 
coded with a predetermined value. The encoding scheme allows representation of the 
headers from number of active VCs (currently 3) as well as that of an idle/unassigned cell. 
By combining this encrypted traffic profile with a lookup table containing the specific byte 
values of the headers for each of the active VCs, one is able to reproduce the timing of a 
traffic stream with specific properties. 

For traffic generation, the card is supplied with a desired traffic profile, encoded as 
described above, and a set of 3 ATM cell headers. As generation proceeds, the traffic 
profile is decrypted and the specified headers loaded into the outgoing SONET fi-ame. As 
mentioned previously, the ATM ceil payload is not considered, but is fixed to some 
predetermined value. Since on-board storage of the traffic profile is finite, , either a traffic 
stream will be fed to the card via a PCI bus or a stored traffic stream will be cycled 
repeatedly, with a period of approximately half a second for 3 VCs. 

Configuration of the board for traffic capture produces a traffic profile file, which is 
written to disk on a PC. Before capture can begin, a set of three ATM headers must be 
downloaded to the board for the lookup table. These headers are used for comparison 
with each header extracted from the incoming SONET frame. A match between a received 
header and one from the look-up table results in a label being assigned in that cell period. 
Headers which do not match those in the table are labeled as that of an idle/unassigned 
cell. In this manner of header extraction, comparison and filtering, and labeling, the timing 
infonmation from the incoming ATM stream can be recorded. 

The card resides in a PCI dot (33 MHz, 5V) of a personal computer. Also required 
for operation of the card is a connection to a PC's RS-232 serial port. When configured for 
traffic capture, the captured traffic profile will be written to hard disk at a rate of 
approximately 0.5 Gbyte/hour. The board's optical driver requires a multi-mode, 1300 nm 
wavelength, SC-style fiber optic connection. 

Implementation for ATM over OC-3: An implementation of the algorithm for where 
ptf =2 and p^^t is shown In Figure 2. The bin counts are tfven by ric =2^ . The shift register 
configuration has been used for the bins and the vectors. The input is SONET Information 
converted into a binary stream. This infomnation is stored and organized in an array of bins 
and vectors. 

The data is processed as follows. Bin 1 receives two bits, adds them up, and 
sends the result to the vector sf and to bin 2. Since bin 2 Is not full yet, then two mora bits 
are read into bin 1 and the result sent to si and to bin 2 . This new result is stored in the 



SUBSTITUTE SHEET (RULE 26) 



wo 98/30059 



CA 02276526 1999-06-30 



PCT/CA97/00991 



17 

first position of si and of bin 2. while the previous values are shifted. Since bin 2 is now 
full, the two elements are added and the result send to S2 and to bin 3. 

Traffic Characterization: Several calculations can be perfomied on the vectors $c 
to characterize the traffic, for example first order statistical measures like variance, 
conflation, and the coefficient of variation, or second order statistics like the Hurst 
parameter H and other fractal dimensions. A methodology using variance-time ounces is 
utilized as follows. The vector v of variances is calculated where each element vc contains 
the variance of the elements In Ihe vector sc- The variances are scaled by dividing each 
element by the square of bin count. The infomiation is represented by a plot of the 
logarithm of v versus the logarithm of the bin count The traffic can then be characterized 
by parameterization of the variance-time cun/es. For example, the slope of the variance- 
time curve is related to the Hurst parameter. 

An example of a real-time plot of the coefficient of variation is shown in Rgure 10. 
The ounces represent JPEG video traffic at different quality factors. Figure 11 illustrates an 
application of the invention in traffic classification. The vertical axis is the log of the 
variance, and the horizontal axis is the log of the bin size Index. The plots represent typical 
variance-time curves of transmissions of video, audio, and ftp (file transfer protocoO 
signals. A variance-tlme cun/e is a plot of the logarithm of the variance of the vectors 
against the logarithm of two to the vector number. The plot for each stream is deariy 
distinct from the others. Since the plots can be constructed in real-time as the vectors are 
being calculated, this technique can be applied in real-time to characterize the traffic from 
measures of the variance-time cun^s. 

The process which generates the Hurst parameter from variance time cun^es is 
illustrated In Figure 12. The Hurst parameter is cateulated at different time inten^als and a 
plot is constructed vWth the different values of H. The resolution of the graph depends ori 
the lenth of the time intenrals. 

Figure 13 shows an application of the algorithm far calculation of the H parameter 
of the 'jump to hyperspace' scene of the StarWars movie. At the centre of the the plot (left- 
hand side image) it is seen that the H parameter increases in value as the images 
changes. This is a motion JPEG encoded transmission of the vkieo over an ATM network. 

Figure 14 illustrates the application of the algorithm in classification of different 
traffic streams. A scene with the character R2D2 from the motion JPEG-coded StarWars 
movie over ATM Is compared agalns an audio (lansmission of the same movie. 
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SimilariyFigure 15 shows that application of the algorithm to the observation of scenes of 
high activity from the motion JPEG-coded StarWars movie. 

The Hurst parameter (H parameter) provides information about the nature of the 
traffic additionai to that which is cunently available in the standards. It is a measure of the 
rate of change of burstiness with respect to changes in time scale. The contribution of the 
present algorithm for traffic characterization applications is the ability to calculated the H 
parameter in real-time. 

Traffic Classification: The characteristics of different traffic streams can be 
characterized by variance-time curves. A set of variance vectors v for different traffic 
streams can be used to train a classifier, for example a neural network. The variances can 
be calculated in real-time from the array of vectors sc and the classification can be 
perform at regular time inten/als, for example every second. This information can be used 
for monitoring. 

An example of traffic classification using variance-time cur/es is shown in Figure 
11. The signals represent FTP (top), video (center), and audio (bottom) over ATM. The 
signals have been characterized by the Hurst parameter H. 

The data in its original form, shown in Figure 11, was presented to several networtc 
architectures in attempt to solve the classification problem. However, it was determined 
that the strong linear trends in the time series made it impossible for the networic to learn 
the subtle variattons in the data. 

To transfonn the data into a suitable fomn for presentation to the networic, the three 
time series of Figure 1 1 were detranded. As the time series appear to be linear, first ortler 
detrending techniques were suitable. Two methods of detrending were considered; (i) a 
least-mean-square fit of a line to the data and (11) detrending by finding the correlation of 
each series. Both methods removed the linear trends from the time series. 

The least-mean-squares method of detrending is well known. The slope and the 
intercept of a line that models the data were determined. Using the slope and intercept 
the trend component of each element in the series was determined and then removed 
from the original series, as shown in the equation below. When the data was prepared In 
this form, it was possible to design a networic that could classify the three data types. 

Stf'St' (slope * t + Intercept) 
where: Sn « the detrended signal 

Si = the original signal 

slope = the slope of the model of the line 

ti = time conresponding to the sample point, / 
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intBtcept B the y-intercept of the line that models the data curve 
it can be seen from Rgure 11 that audio data is highly correlated, video data is less but 
somewhat correlated and FTP data shows almost no degree of coirelation. 

Noticing that the three data types could be distinguished by their degree of 
correlation, a simpler method of deirending is provided in which firstly the slope and the 
intercept of each time series Is calculated. Each time series is then detrerxled as follows 

Stf = \Si-Si*i\*iniBic^t 
This method finds the correlation of the signal by taldng the absolute dHference in 
successive signal amplitudes. This value Is then raised by the intercept of the line that 
models the data curve. When the data is detrended in this manner, it is possible to design 
a network that could classify the three data types. Signals detrended by this method are 
shown in Figure 16 

Although data detrended by the method of least-mean-squares allowed a network 
to classify the data, the second method of detrending is less computationally intensive. 
The second method is equally successful in removing the linear trend infbmiation and it 
involved only addition and subtraction operations whereas the method of least-mean- 
squares involved a muitiplicatton operation. Reducing the complexity of preprocessing Is 
targeted to classify the data in real-time. 

In order to solve this data classification problem, three neural network architectures 
can be attempted. First, a multi-layer feed-fbnvard network may be considered. The 
weights are updated using a back propagation algorlthra However, it is not possible to 
detennine a networic of this type that could learn to classify the input vectors. Even using 
momentum, the network's sum-squared error becomes stuck in a local minimum and is 
never able to reach the error goal. 

Next, a LVQ (Unear Vector Quantization) networic can be designed. The networit 
consisted of 15 inputs, 3 tan-sigmoidal neurons in the hidden layer and 3 linear output 
neurons. This network is able to successfully classify the three data types. 

Although it is not obvious by observing the input vectors of Figure 16, the three 
classes of input vectors are linearly separable. This is detemiined by experimenting with a 
third network: a competitive network. The competitive network that solves this problem is 
shown in Figure 17. The networic consists of 15 inputs and 3 perceptrons in the output 
layer. As peroeptrons are able to classify the three data types, it is deiennined that the 
data must be lineariy separable. This network architecture is ^red over the LVQ design 
as it involves fewer weights and neurons. It can been seen Figure 18 that the competitive 
networic found the three data dusters. 
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Twenty percent of the input vectors are set aside for testing. Once training was 
completed, Vne network is tested on the remaining 600 input vectors. After 500 training 
epochs, the network is able to classify all 600 input vectors into three classes without 
emor. 



Traffic Prediction: The aray of vectors Sc can be used to predict traffic. A set of 
vectors 5/. f and s/ can be used as a training set for a neural network predictor. Once the 
neural network is trained it can take V^b input from a vector s/-f in real-time and predict 
elements of s/. This infdmiation can be used by different layers of protocols to handle 
congestion, call admission control, and in general to monitor a source. 

Performance Predictbn: The following describes a method for estimating the maximum 
rate of constant bit rate traffic which can be added to a given trafTtc stream without 
overflowing a buffer of fixed size during a time window of fixed duration. Let // denote 
the rate at which cells are removed from a buffer of size B and let denote the number 
of cells which arrive to the buffer in the time inten^al (s,t). It is v^il known that the queue 
length (i.e. the number of ceils in the buffer) at time t is given by max where 

^A,f-fi(t-5). For example, in Figure 19, suppose that we know^, for every point 
(s,t) in the plane. The queue length at time is the maximum value of along the line 
segment AB of Figure 19. 

If the maximum queue length is required in the interval (0,/,). we can simply take 
the maximum of along all the line segments parallel to AB (for example at , etc.) 
and then find the largest of those maximum values. However, this is equivalent to just 
taking the maximum of over the entire triangular region ABC. We can envision taking 
this maximum in a different way, as lllustFated Figire 20 We first find the maximum of W„ 
along each of the line segments parallel to CB (for example , the segments labeled t = s, 
r = j+a, . / = j-i-a,) and then find the largest of those values. 

If we find the maximum in this way, we can express the maximum number of cells 

in the buffer during the time interval (s,t) by ttie following: 

M^iM)-msx\nzxW^y max 4max W^^^„ U max /max A^^^^-ua . 
We now employ a heuristic approximation: 
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max A,.^„ ^ml 

where 

and where [Jf J denotes the largest integer not larger than x (i.e. the floor function or 
tmncation ) . in words, is defined as follows: Divide the time interval(s,t) into a 
number of smaller , non-overlaR)lng intenrals of length cu Count the number of cells 
aniving in each of those small inten^als and find the maximum of those numbers. The 
result is . The exact calculation is similar, except Uiat the intervals are overlapping. 
For example, if a=4, s=0 and t=16, the approdmate calculation uses the tntervals 
(0,4),(5,8),(9,12) and (13,16) whereas the exact calculation uses the intenrals 
(0.4).(1.5).(2,6).(3,7) (12,15) and (13,16), In the exact calculation max A , we take 

the maximum value of i4,^^„ for all possible values of x (i.e. x=5,s-^ J,s+2,...,f-a;. In the 
approximation wj^, we take the maximum of only the values of corresponding to 
disjointmtervals(x,x+a) (l.e. x=j,jr+a,5-H2a,..sr-a), 

The calculation of the values can be done efficiently in real time using a 
method similar to that described above for the calculation of the variance-time curve. We 

employ a series of m bins labelled 1.2 m. Each bin is made up of two processing units 

which can store one integer each. A stream of bits representing the presence "0" or 
absence "1" of a cell (packet) In each transport locatiOT is fed into the first bin. Each bin 
begins in a cleared state, with no integer stored in e«her processing unit. If a bin in a 
cleared state receives an integer, it stores the integer in the first of It's processing units. If 
a bin which is not in a cleared state (i.e, it has an integer stored in one of ffs processing 
units) receives an Integer, it v^ll place the new integer In its second processing unit, 
calculate the sum of the two integers in its processing unit and pass ttie sum to tiie next 
bin (i.e. bin 1 passes to bin 2. bin 2 passes to bin 3 etc.) . The result of tills process is ttiat. 
at any time, an integer stored in a processing unit of bin c represents ttie sum of 2 * 
consecutive bits fed into ihe first bin. This in turn corresponds to ttie number of cells 
(packets) aniving In a time window of duration 2 . The bin also passes this sum to a 
maximum filter (described below) and returns to a cleared stete, erasing the contents of 
both processing units. 

Assodated wHh each bin is a maximum filter. We thus have m maximum filters 
labelled 1.2,...m in the same way as the bins . Each maximum filter consists of an input 
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port, a memory , a counter , an alamn and an output port Each of these four elements can 
store one integer. When an integer amves at the input port of a maximum filter from its 
corresponding bin, the filter compares the integer in the kiput port to the integer in 
memory. The filter then discards the smaller of the two integers, moves the larger of the 
two integers into its memory, increments the integer in its counter by 1 and compares the 
counter to the alarni. If the integers match, then the integer in memory is moved to the 
output port, thus ovenAmting the integer in the output port, and the biteger in memory is set 
too 

Associated with each bin is a vector similar to the vectors 5^ described in the 
method for calculating variance-time curves. Each integer which appears at the output 
port of maximum filter c is passed to vector which records integers passed to it in 
sequence, dropping the least recent ones when full. If a Is an integral power of 2, say 

a = 2% then ml 's the maximum of the most recent ["^J integers passed to maximum 
filter c. In practice, [~"J be quite large when a is small and so we can not store 
a'i J ©teiTT^ents at once. This is the reason for the maximum fillers. The value of ml 

can be obtained by finding the maximum of the most recent |^"^ J Integers in the vector 

5^ wtiere or = 2* providing that the alamn in maximum filter c is set to S/a = 2"'^ . We 
assume that S is an integral power of 2, say =2*^, so that the elann In filter c must be 
set to 45/0 = 2""*. This effectively breaks up the calculation of ml by dividing the 
intenral(s.t) into a number of smaller intervals of length 6, taking the maximum over each 
of the smaller Inten^als and calculating ml as the maximum of those. 

In this manner we can easily keep track of the values of m'^ , for any value A of 
Interest for a = 1,2,4,— where t represents the cuaent time. We are interested in the 
maximum number of cells in the buffer in the time interval (/ - A,r) which is given by 

For each value of c =1.2 m we have a value of where a = 2*. We 

subtract pa = from this value for each of c=1,2,...,m and find the maximum of the m 
resulting values. We estimate M-a^iC") by fitting a quadratic function to a small number of 
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points of the form (a,m,",^ , - fja) with values of a centred around the integral value of a 
where the maximum occurred. The operation referred to as "fitting a quadratic function « 
refers to finding the parameters of a quadratic curve which passes through or as near as 
possible to the points in question. Methods for fitting a quadratic function are available in 
the literature. 

Note that it is only the last step which depends on the value of // . the service rate 
for the buffer. We can thus repeat the last step for a number of different values of p 
without having to repeat the measurements involved in filling the vectors s 

c ' 

The effective bandwidtti is defined as the minimum value of fi for which the 
maximum number of cells M,^, (p) in the buffer does not exceed the buffer capacity B for 
the duration of the time window of length A . We can calculate this quantity at any time by 
perfbmiing a binary search fbr this value of p. A binary search consists of evaluating the 
function M,^^(p) for two values of p. sayp, and ^. and continually updating 
the values of p^ and p„ such that the size of the intenrai (p^^.p^) is decreased by 
half at each iteration and always contains the value of fbr which M,^,(p)=B. The 
method of binary search is well l<nown and can be fbund in the literature. 

Projection of Long Tenn Effective Bandwidth: Let p^t,A.B) denote the effective 
bandwidth described above: i.e. p^it,\B) represents the minimum value of ;i for which 
M;_^(p)^B where M',^{p) denotes the approximation described above for the 
maximum number of calls in the buffer during the time window (r- A,/) . Suppose that at 
time t we have been obsenrhig a traffic stream fbr some length of time o and wish to 
estimate the bandwidth pJf,Cl.B) required to prevent buffer overflow during some time 
wln<tow of length Q where ft>a,. We will assume that a, = 2^ .J for some Integer J 
(otheoMse we can simply decrease « acoordingly) . Now define E,(t, p) to be a measure 
of the average value of M'^, 0*) over the mtenral of length «> when A = 2* ^ . Specifically: 

In words, we divide the intenral of length toil's into 2^'-*> inten«ls of length 
A = 2*tf and estimate the maximum queue length over each of these intervals. The 
average of these values is E,it,p) m practice we have seen that the variation of E,{Up) 
with can be approximated by the following relation: 

^°iA^kiKM)]=a(f,p)^kb{t,p). 
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Thus if we fix t and and plot the logarithm of E^{i,^) as a function of k, we get 
something that looks dose to a straight line. Our method for projecting the effective 
bandwidth over the long term n consists of estimatffig the coefficients Q{t,n) and b{t,p) 

by fitting the points ^^,log2[jE;(f,/i)]]^ = 0,1,— J to a straight line and then extrapolating 
a value for A/,.Q.X/i) by extending the line out further. Fitting a straight line consists of 
finding the line that passes closest to the points and methods for doing this are available m 
the literature. We thus estimate M-o^iO') according to: 

Efficient Calculation of JE;(r, fi) : We can calculate the values of efficiently 
in real-time as follows. Let denote the ; th integer passed from maximum filter c to its 
corresponding vector\y^. If we divide the time intenAalO*J,0' + l)^) into intervals of length 
then is the maximum of the numbers of cells arriving in each of these intervals. 
With each value of c we associate a column of processors. Each processor has one 
register which can store an integer, one input and one output. When the register is empfy, 
the processor waits for an integer to appear at its input and stores It in the register upon 
arrival. When the register is full, the processor waits for the arrival of a secorid integer at 
the input Upon arrival of the second integer, the processor outputs the maximum of the 
two successive inputs and clears the register These processors are similar to the bins 
refen^ed to above except that they output the maximum of the two inputs instead of the 
sum. In each column of processors, the output of one processor is fed into the input of the 
next processor in the column. Thus, if successive values of are passed to the first 
processor in the column c of processors, then, at any time, the k th processor in column c 
contains the maximum of the most recent 2* values of m] passed to the column of 
processors. We can think of aoanging these processors in a rectangular array with the 
processors in each column aranged vertically from top to bottom as in Figure 21. We 
denote the * th processor in column c by ij^. Also, we refer to the collection of the * th 
processors from all the columns (i.e. /Jj.ii^,— .P^,) as the th row of processors. At any 
time f , the /c th row of processors contains the values of w*,*, for a = 1 2 4 
Periodically, each row of processors is polled aid the values of m" ^'^^ are used to 
calculate A^'.j'^.iC/O'or various values of ^. These values are in tum fed Into row of 
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processora which output the sum of successive inputs so that the / th processor in the 
* th low of IWs summing array always contains the sum of the 2' most recent vaiues of 
These provide the value ofthe sum In the expression for £,«;;,)above ifwe 
take i = J-k. In this manner we can . in real-time, efficiently keep track of afl the 
quantities necessaiy to make a long-temi effective bandwidth projection. 

Call Admission Control: The estimation of effective bandwidth can be used 
in two ways, in the first way. we have a number of existing sources sending packets into a 
network. We can estimate the affective bandwidth of the traffic from all of those sources at 
some point in the networic if another souroe requests to begin sending additional traffk: 
through the same point in the network the network will reject the request If the sum of the 
effective bandwidth calculated and a peak bandwidth proposed in the request exceeds the 
capacity of that section of the netwofk. AHematfveiy, the networic could decrease the 
effective bandwidth of the existing traffic by aUocating more buffer space. 

The second application is slightly different. Suppose that a given tr^c 
stream (for example a video-on-demand service) is fed from one locatfon on the network 
to a multiplicity of other locations on the network. If another location on the network which 
■s not receiving the transmission requests reception of the transmission, a connection will 
have to be set up from the location providing the sen^ice to the location requesting it In 
this call setup, (he sender can specify the equivalent bandwidth to nodes on ihe network 
whfch must carnr the traffic from the senrer to the new recipient. Even if these nodes do 
not use a protocol which involves the effective bandwidth, the effective bandwidth could 
simply be sent to them In place of tiie peak bandwidth and those nodes will set up the 
connection as if this was the actual peak bandwkflh. Alternatively, the server could send 
both a buffer requirement and a corresponding equival^it faandwidtt, requirement and the 
ofl^er nodes could react accordingly by making use of a protocol which employs 
information about effective bandwidtti. 
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CLAIMS: 

1. A method for deriving information related to characteristics of 
transmissions in a packet network comprising: 

providing a packet network for carrying a plurality of transmissions from at 
least one source in which the transmissions from the or each source are divided into a 
plurality of sequential packets each packet having address data defining an intended 
address, information data defining information to be transmitted and id data defining a 
source identity; 

the network deftiing a train of sequential packet transport locations into 
which packets are loaded for transmission, such that some packet transport locations in a 
train contain packets and some packet transport locations are empty and such that, when 
there is more than one different source, the trah contains packets from the different 
sources in a sequential anangement as determined by the network; 

monitoring a train of packet transport locations to detenmine which packet 
transport locations ara empty and which contain a packet; 

generating a series of data elements each corresponding to a respective 
one of the packet transport locations and each identifying whether the respective packet 
transport location is empty or whether the respective packet transport location contains a 
packet; 

and canying out statistical analysis on the series of data elements to 
determine the characteristics of the transmissions. 

2. The method according to claim 1 wherein the statistical analysis is 
carried out in real time. 

3. The method according to daim 1 wherein the data elements are 
stored for subsequent analysis and the statistical analysis is earned out subsequent to 
completion of the transmissions. 

4. The method according to daim 1 wherein the statistical analysis is 
carried out at a plurality of different time scales. 

5. The method according to daim 4 wherein the statistical analyses 
are carried out simultaneously. 

6. The method according to claim 5 wherein the statistical analyses 
are earned out by providing for each different time scale a respective one of a plurality of 
registers and entering information from the data elements Into each register sequentially. 

7. The method according to claim 6 wherein the data elements 
comprise data bits defining "0" when the respective packet transport location is empty and 
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"1" when the respective packet transport location contains a packet and wherein the 
information for each register is obtained by adding the contents of a next adjacent 
previous register. 

8. The method according to claim 7 wherein the analysis includes for 
each register calculating the sample variance of a set of successive obsen^ations of the 
register contents and from the variances estimating a value of the Hurst parameter H, 
which is the slope of a line which approximates the behavior of a plot of the logarithm of 
the variances of the registers versus the values of the sequential Indices of the registers. 

9. The method according to daim 1 wherein the packets in the train 
are provided by a plurality of different sources and wherein the data elements are 
anBnged to identify a packet transport location as containing a packet only when the 
packet is identified from the id data as provided by a selected one of the sources such that 
the characteristics detennined relate to only the transmissions from the selected source. 

10. The method according to claim 1 wherein the packets in the train 
are provided by a plurality of different sources and wherein the data elements are 
arranged: 

to identify a packet transport location as empty when no packet from any of 
the sources is contained; 

to identify when a packet transport location contains a packet from the W 
data as provided by each one of the sources v»*itah source provided the packet 

11. The method according to claim 1 wherein the characteristics 
detennined from the data elements are used to provide a calculation of an effective 
bandwidth of the transmissions. 

12. The method according to claim 1 for detennining whether a source 
additional to a plurality of existing sources of packet transmissions, each source having a 
predetennined peak rate of packet transmission, can be connected to a packet network, a 
transmission medium of the network having a predetennined maximum allowable peak 
rale of transmissions, including the steps of: 

canrying out In real time the statistical analysis on the series of data 
elements to determine an effective bandwidth of the transmissions from the existing 
sources; 

and cateulating whether the additional source can be connected by 
comparing the effective bandwidth, the predetennined peak rate of packet transmission of 
the additional source and the predetermined maximum allowable peak rate of 
transmissions of the transmission medium of the network. 
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13. The method according to claim 1 for determining whether a source 
additional to a plurality of existing sources of padcet transmissions, each source having a 
predetemrdned peak rate of packet transmissfon. can be connected to a second packet 
network, a transmisston medium of the second packet network having a predetemiined 
maximum allowable peak rata of transmissions, including the steps of: 

connecting the additional source to the packet network; 

generating said series of data elements from transmisstons from sakl 
additional source to sakl packet network; 

carrying out in real time the statistkal analysis on the series of data 
elements to detemiine an effective bandwidth of the transmissions Item said additkmal 



source; 



and calculating whether the additional source can be connected to the 
second packet networi. by using the effective bandwklth of the transmissfens ftom said 
additional source. 

14. A method for deriving infonnation related to the characteristics of 
transmissions in a packet network comprising: 

providing a packet networi( for canying a plurality of transmissions from at 
least one source in which the transmissions fmm the or each source are divided into a 
plurality of sequential packets each packet having addrass dala defining an intended 
address, infomiation data defining infom.ation to be transmitted and id data defining a 
source Identify; ^ 

the networic defining a train of sequential packet transport locations hto 
Which packets are loaded for transmission, such that some packet transport locations In a 
tram contain packets and some packet transport locations are empty and such that when 
them IS more than one different source, tiie train contains packets from the different 
sources in a sequential arrangement as detemiined by the networic; 

monitoring a train of packet transport locations to detemiine which packet 
transport tocations are empty and which contain a packet; 

generating infomiation defining which packet transport locations contain a 
packet and tiie empty locations ttiei^between; 

and canying out simultaneously and in real time a series of statistical 
analyses on the Infomiation at a plurality of different time scales to detemiine tiie 
characteristics of the transmissions. 

15. The mettiod according to daim 14 wherein ttie infomiation 
compnses a series of data elements each conwponding to a respective one of the packet 
transport locations and each Wentifying whetiwr the respective packet transport location is 
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empty or whether the respective packet transport location contains a packet and wherein 
the statistical analyses are carried out by providing for each different time scale a 
respective one of a plurality of registers and entering information from the data elements 
into each register sequentially. 

16. The method accorifing to daim 15 wherein the data elements 
comprise bits which define "0" when the respective packet transport location Is empty and 
"1" when the respective packet transport kication contains a packet and whwein the 
Information for each register is obtained by adding the contents of a next adjacent 
previous register. 

17. The method according to daim 16 wherein the analysis mdudes for 
each register calculating the sample variance of a set of successive observations of the 
register contents and from the variances estimating a value of the Hurst parameter H, 
which is the slope of a line which approximates the behavior of a plot of the logarithm of 
the variances of the registers versus the values of the sequential indices of the registers. 

18. The method according to daim 14 wherein the packets in the train 
are provided by a plurality of diffsrent sources and wherein the information is arranged to 
identify a packet transport location as containing a packet only when the packet is 
identified from the id data as provUed by a selected one of the sources such that the 
characteristics detemiined relate to only the transmissions from the selected source. 

19. The method acconiing to claim 14 wherein the packets in the train 
are provided by a plurality of different sources and wherein the Information is arranged: 

to identify a packet transport location as empty when no padtet ftom any of 
the sources is contained; 

to identify when a packet transport tocatnn contains a packet from the M 
data as provided by each one of the sources which source provided the packet 

20. The method acconiing to claim 14 wherein Oie characteristics, 
determined from the information are used to provide a calculation of an effective 
bandwMth of the transmissions. 

21 . The method according to daim 1 4 for detemiining wrtiether a source 
addHtonal to a plurality of existing sources of packet transmissfons, each source having a 
predetemnined peak rate of padwt transmisston, can be connected to a packet networit. a 
transmission medium of the networic having a predetemnined maximum allowable peak 
rate of transmisskMis, induding the steps of: 

carrying out in real time the stetistical analysis on the information to 
detannine an effedhre bandwkJth of the transmissions from the existing sources; and 
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and calculating whether the additional source can be connected by 
comparing the effective bandwidth, the predetemnined peak rate of packet transmission of 
the additional source and the predetennined maximum allowable peak rate of 
transmissions of the transmission medium of the network. 

22. The method according to daim 14 for detemnining whether a source 
additional to a plurality of existing sources of packet transmissions, each source having a 
predetemilned peak rate of packet transmission, can be connected to a second packet 
network, a transmisskin medium of the second packet network havng a predetannined 
maximum allowable peak rata of transmissions, including the steps of: 

connecting the additional source to the packet network; 

generating said infennation from transmissions from said additkinal source 
to said packet network; 

carrying out in real time the statistical analysis on the infbnnatkin to 
detennine an effective bandwidth of the transmissions from said additional source; 

and calculating whether the additional source can be connected to the 
second packet network by using the effective bandwMth of the transmissions from said 
additional source. 

23. A method of generating packet transmissions for simulating a 
source having required transmisston characteristics fbr transmitting on a packet network 
comprising: 

providing a packet network fbr carrying a plurality of transmissions from at 
least one source in which the transmissions from the or each source are divided into a 
plurality of sequential packets each packet having address data defining an intended 
address, infbmiation data defining informatkm to be transmitted and id data defining a 
source iden%; 

the network defining trains of sequential packet transport kxatlons into 
whfch packets are toaded for transmisskm. such that some packet transport locations in a 
tram contain packets and some packet transport locations are empty and such that, when 
there is more than one different source, the train contains packets from the different 
sources In a sequential arrangement as detemiined by the network; 

from a statistical analysis of prevkxjs actual transmissions on the network, 
generating fbr the simulated source the required characteristic: 

generating from the required charactoristk: a series of data elements each 
conBsponding to a respective one of the packet transport tocations and each specifying 
whether, in a simulated train of packets, a respective packet transport tocatlon is empty or 
whether the respective packet transport location contains a packet; 
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and creating from the data elements the simulated packet train. 
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